CVE-2026-89307 in Design Scuole Italia Plugin

Résumé

par MITRE • 15/09/2026

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsable: ENISA
• Réserver: 11/09/2026
• Divulgation: 15/09/2026
• Modérer: accepté
• Entrée: VDB-404339
• CPE: prêt
• CWE: CWE-79 (confirmé)
• CVSS: 3.5 (VulDB)
• EPSS: 0.00000
• KEV: non
• Activités: très faible

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-89307
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89307
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-89307/